“It is time Facebook is held accountable for how it handles consumers’ personal information,” Attorney General Letitia James said in a statement. “Facebook has repeatedly demonstrated a lack of respect for consumers’ information while at the same time profiting from mining that data.”
Starting in May 2016, Facebook automatically collected users’ contact lists, ultimately collecting data on more than 1.5 million people. That data was then used to improve the social media company’s ad-targeting algorithms and other operations on the platform.
Facebook said that the collection and use of this data was an “unintentional” consequence of a system used to verify user identities, and it was quickly shut down after Business Insider first reported the practice earlier this month.
Users did not consent to handing over their contacts to Facebook.
“Facebook’s announcement that it harvested 1.5 million users’ email address books, potentially gaining access to contact information for hundreds of millions of individual consumers without their knowledge, is the latest demonstration that Facebook does not take seriously its role in protecting our personal information,” James said.
According to The New York Times, the New York attorney general’s investigation will focus primarily on how the incident occurred and the total number of people affected.
Yesterday, Facebook announced in its quarterly earnings that it is anticipating a fine anywhere between $3 and $5 billion from the US Federal Trade Commission as a settlement payment following the agency’s investigation into the Cambridge Analytica scandal and the potential privacy violations that followed suit. It’s unclear when the FTC will formally announce the settlement or what the actual dollar amount will come out to in the end